Warning! It looks like trusted-proxies is not set correctly in this instance's configuration. #5

New Issue

2025-04-25T01:42:04Z

Brooke commented

2025-04-25 01:42:04 +00:00

No description provided.

Brooke commented

2025-04-25 01:46:49 +00:00

This issue is only applicable to testing 0.18.0

From reading the docs this should be fixed by setting GTS_TRUSTED_PROXIES but even setting a /0 cdir it doesn't seem to affect the error. Something of note is that the IP is different on all deployments so you can't just set /32, the recommended solution also doesn't work as it relies on suggested ip range (172.17.0.1/16). In my testing the error would list something like 10.0.x.x but setting 10.0.0.0/16 doesn't fix it either.

Furthermore, it seems like any "fix" would essentially disable the rate limiting feature, honestly I'm not even positive it was working on 0.17.0 either. So, maybe this warrants deeper discussion into how traefik x-forwarded-for should work ¯\_(ツ)_/¯

This issue is only applicable to testing 0.18.0 From reading the docs this should be fixed by setting GTS_TRUSTED_PROXIES but even setting a /0 cdir it doesn't seem to affect the error. Something of note is that the IP is different on all deployments so you can't just set /32, the recommended solution also doesn't work as it relies on suggested ip range (172.17.0.1/16). In my testing the error would list something like 10.0.x.x but setting 10.0.0.0/16 doesn't fix it either. Furthermore, it seems like any "fix" would essentially disable the rate limiting feature, honestly I'm not even positive it was working on 0.17.0 either. So, maybe this warrants deeper discussion into how traefik x-forwarded-for should work ¯\\\_(ツ)_/¯

decentral1se commented

2025-04-25 08:53:17 +00:00

Reminds me of coop-cloud/peertube#7.

Here's two config excerpts from trusted proxy configs but yeh, maybe you need host mode networking for this 😬

		peertube/compose.yml
		Line 57 in 2744684292
	
				      - PEERTUBE_TRUST_PROXY=["127.0.0.1", "loopback", "172.16.0.0/12", "10.0.0.0/8"]

		rauthy/rauthy.cfg.tmpl
		Lines 1090 to 1099 in 83976da02c
	
				# A `\n` separated list of trusted proxy CIDRs.

				# When `PROXY_MODE=true` or `PEER_IP_HEADER_NAME` is set,

				# these are mandatory to be able to extract the real client

				# IP properly and safely to prevent IP header spoofing.

				# All requests with a different source will be blocked.

				TRUSTED_PROXIES="

				127.0.0.1

				172.16.0.0/12

				10.0.0.0/8

				"

Reminds me of https://git.coopcloud.tech/coop-cloud/peertube/issues/7. Here's two config excerpts from trusted proxy configs but yeh, maybe you need host mode networking for this 😬 https://git.coopcloud.tech/coop-cloud/peertube/src/commit/2744684292d66053a9681ac57692b9f026863dde/compose.yml#L57 https://git.coopcloud.tech/coop-cloud/rauthy/src/commit/83976da02c3e032505668150c24bc2dc71f3bd2f/rauthy.cfg.tmpl#L1090-L1099

Brooke commented

2025-04-25 17:51:50 +00:00